Merge pull request #8 from lauradreith/main

Add IAM user long-term credentials network control

Author: lauradreith

Protect-cloud-platform-resource/Deny-use-of-IAM-user-credentials-from-unexpected-networks.json

@@ -0,0 +1,47 @@
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "EnforceNetworkPerimeterOnIAMUsers",
+            "Effect": "Deny",
+            "NotAction": [
+                "es:ES*",
+                "dax:GetItem",
+                "dax:BatchGetItem",
+                "dax:Query",
+                "dax:Scan",
+                "dax:PutItem",
+                "dax:UpdateItem",
+                "dax:DeleteItem",
+                "dax:BatchWriteItem",
+                "dax:ConditionCheckItem",
+                "neptune-db:*",
+                "kafka-cluster:*",
+                "elasticfilesystem:client*",
+                "rds-db:connect"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "BoolIfExists": {
+                    "aws:ViaAWSService": "false"
+                },
+                "NotIpAddressIfExists": {
+                    "aws:SourceIp": [
+                        "<my-corporate-cidr>"
+                    ]
+                },
+                "StringNotEqualsIfExists": {
+                    "aws:SourceVpc": [
+                        "<my-vpc>"
+                    ]
+                },
+                "ArnLike": {
+                    "aws:PrincipalArn": [
+                        "arn:aws:iam::*:user/*"
+                    ]
+                }
+            }
+        }
+    ]
+}
+

Protect-cloud-platform-resource/Protect-cloud-platform-resource.md

@@ -18,3 +18,4 @@ Enforce controls to protect your resources in cloud from being modified or delet
 | [Deny key actions on Route53 DNS hosted zones](Deny-key-actions-on-Route53-DNS-hosted-zones.json) |Deny route53 domain transfer, modification and deletion.|
 | [Prevent IMDSv1](Prevent-IMDSv1.json) |EC2 instances obtain credentials for the instance IAM roles through the Instance Metadata Service (IMDS).IMDSv2 is the most recent secure version of this service, the older version, IMDSv1, should therefore be prevented.|
 | [Enforce 30 days for KMS key deletion](Enforce-30-days-for-KMS-deletion.json) |Safeguards production KMS keys by enforcing a minimum 30-day cooldown period before key deletion. This policy helps prevent accidental or unauthorized deletion of critical encryption keys, ensuring the security and availability of encrypted data in production environments.|
+| [Deny-use-of-IAM-user-credentials-from-unexpected-networks.json](Deny-use-of-IAM-user-credentials-from-unexpected-networks.json) |Deny use of IAM user long-term access keys from outside of your corporate network or VPCs. We recommend using [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) instead of IAM users with long-term access keys, as these access keys remain valid until manually revoked and therefore present a higher security risk. If you still use IAM users in your organization, implement network restrictions to limit exposure and reduce potential misuse.|